IBM DataStage EUVD-2026-119728

Requires a valid authenticated session on IBM DataStage on Cloud Pak for Data 5.4.0.0 (PR:L), so exploitation is limited to users who already possess platform credentials; no user interaction is needed (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L). The exact feature, endpoint, or parameter that accepts the traversal input is not described in the available sources. Limiting factors: authentication requirement confines the attack to insiders or attackers with stolen/low-privilege credentials, and only the specified 5.4.0.0 release is identified as affected; impact is bounded to file deletion (integrity/availability), with no confidentiality disclosure per the vector.

This is a moderate-severity, authenticated path traversal (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 permitting arbitrary file deletion. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L, base 6.4) indicates network-reachable, low-complexity exploitation but requires at least low-level privileges (PR:L), so an attacker must already be an authenticated user of the platform - this is the single largest limiting factor and keeps the vulnerability out of the mass-scan/wormable category. The scope change (S:C) reflects that file deletion in the DataStage component can affect the broader Cloud Pak for Data host or adjacent components beyond the vulnerable app's own authorization boundary. No EPSS score, KEV listing, or POC/exploit reference was provided, so there is no signal of active exploitation or public exploit code; the vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-this-cycle rather than drop-everything priority. Signals are internally consistent: a credentialed-attacker integrity/availability issue with a vendor patch available, no exploitation evidence. The chief missing data points are EPSS probability and any independent confirmation of which fix version remediates it - the reference is a single IBM support advisory not parsed into a specific fixed build here.

An attacker who holds valid low-privilege credentials on the DataStage on Cloud Pak for Data instance sends a crafted request containing directory traversal sequences (e.g. ../) in a filename or path parameter, causing the application to delete a file outside the intended directory. By removing configuration, log, or other service files on the host, the attacker degrades integrity and availability of the platform. No public exploit identified at time of analysis; the specific vulnerable endpoint and trigger are not described in the available sources.